Security Strategic Planning ACCISO Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A CISO wants to measure the effectiveness of the security strategy in reducing the impact of security incidents. Which metric would be most appropriate?

   • APercentage of systems patched within 30 days.
   • BNumber of security policies updated per year.
   • CNumber of security staff certifications.
   • DAverage cost per security incident.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A regional bank is developing its annual security plan. The board has approved a risk appetite that accepts moderate risk for customer-facing digital services but requires near-zero tolerance for core banking system outages. The CISO must allocate the security budget for the next fiscal year. Which approach best aligns the security strategy with the bank's risk appetite?

   • ADistribute the budget evenly across all business units to ensure fair coverage of both digital services and core banking systems.
   • BDefer all security investments until a full enterprise risk assessment is completed next quarter.
   • CPrioritize investments that harden the core banking systems and implement compensating controls for digital services, accepting the approved moderate residual risk.
   • DFocus the entire budget on digital services because they generate the most revenue and are the primary target for attackers.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company's risk assessment identified two major risks: ransomware affecting production systems and insider threat from privileged users. The CISO must develop a security strategy with limited budget. Which approach best integrates risk management into the strategy?

   • AFocus only on the ransomware risk because it is more publicized.
   • BDefer both risks until the next budget cycle.
   • CDevelop initiatives that address both risks, prioritizing based on likelihood and impact, and allocate budget accordingly.
   • DImplement a single solution that claims to address both risks, regardless of effectiveness.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A startup is creating its first security strategic plan. The founders want the plan to support rapid growth and innovation while protecting intellectual property. They have limited resources and no dedicated security team. Which first step should the CISO take?

   • APurchase a comprehensive security suite to establish a baseline.
   • BConduct a detailed risk assessment of all business processes.
   • CHire a team of security engineers to build an in-house capability.
   • DDefine the security vision and mission aligned with the company's growth goals.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company has a security budget of $500,000. The risk assessment identifies three risks: a high-likelihood, low-impact risk (A), a medium-likelihood, medium-impact risk (B), and a low-likelihood, high-impact risk (C). The CISO must allocate the budget. Which allocation best reflects strategic prioritization?

   • AAllocate the budget equally among the three risks to ensure all are addressed.
   • BAllocate the entire budget to risk A because it has the highest likelihood.
   • CAllocate the budget based on the expected loss reduction for each risk, prioritizing the risk with the highest expected loss.
   • DAllocate the entire budget to risk C because it has the highest impact.
   Reveal Solution Discussion Select an answer first